Bug 1542934 strong ref arguments for functions that may run CustomElementConstructor::Construct() r=smaug

Differential Revision: https://phabricator.services.mozilla.com/D26633

--HG--
extra : moz-landing-system : lando

dom/base/CustomElementRegistry.cpp

@@ -329,8 +329,8 @@ CustomElementRegistry::RunCustomElementCreationCallback::Run() {
   MOZ_ASSERT(NS_SUCCEEDED(er.StealNSResult()),
              "chrome JavaScript error in the callback.");
 
-  CustomElementDefinition* definition =
-      mRegistry->mCustomDefinitions.GetWeak(mAtom);
+  RefPtr<CustomElementDefinition> definition =
+      mRegistry->mCustomDefinitions.Get(mAtom);
   MOZ_ASSERT(definition, "Callback should define the definition of type.");
   MOZ_ASSERT(!mRegistry->mElementCreationCallbacks.GetWeak(mAtom),
              "Callback should be removed.");

dom/base/nsContentUtils.cpp

@@ -9540,7 +9540,7 @@ nsresult nsContentUtils::NewXULOrHTMLElement(
   // We only handle the "synchronous custom elements flag is set" now.
   // For the unset case (e.g. cloning a node), see bug 1319342 for that.
   // Step 4.
-  CustomElementDefinition* definition = aDefinition;
+  RefPtr<CustomElementDefinition> definition = aDefinition;
   if (isCustomElement && !definition) {
     MOZ_ASSERT(nodeInfo->NameAtom()->Equals(nodeInfo->LocalName()));
     definition = nsContentUtils::LookupCustomElementDefinition(
@@ -9620,8 +9620,9 @@ nsresult nsContentUtils::NewXULOrHTMLElement(
     // Step 6.1.
     if (synchronousCustomElements) {
       definition->mPrefixStack.AppendElement(nodeInfo->GetPrefixAtom());
-      DoCustomElementCreate(aResult, nodeInfo->GetDocument(), nodeInfo,
-                            definition->mConstructor, rv);
+      RefPtr<Document> doc = nodeInfo->GetDocument();
+      DoCustomElementCreate(aResult, doc, nodeInfo,
+                            MOZ_KnownLive(definition->mConstructor), rv);
       if (rv.MaybeSetPendingException(cx)) {
         if (nodeInfo->NamespaceEquals(kNameSpaceID_XHTML)) {
           NS_IF_ADDREF(*aResult = NS_NewHTMLUnknownElement(nodeInfo.forget(),